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Abstract 

The  purpose  of  this  report  is  to  describe  the  National  Institute  of  Standards  and 
Technology’s  work  to  date  relating  to  the  general  methodology  being  developed  for 
the  project  Risk  Analysis  for  the  Fire  Safety  of  Airline  Passengers  and  the  software 
being  used  to  facilitate  this  methodology.  The  approach  selected  involved  the  use 
of  influence  diagrams.  Therefore,  a brief  discussion  of  influence  diagrams  is  given. 
The  status  of  their  application  to  the  water  mist  system  for  passenger  planes 
is  given  and  the  overall  approach  to  carrying  out  the  project  is  described.  An 
example  is  included  that  shows  how  the  process  works,  but  the  case  is  fictional, 
not  intended  to  be  realistic. 

Keywords:  risk  analysis,  risk  management,  probability,  decision  analysis,  artificial 
intelligence,  fire  research 
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1.  Introduction 


Airline  fire  safety  is  important  for  airline  passengers  and  for  the  potential  flying 
public  that  needs  to  be  assured  of  the  safety  of  flying.  The  public  is  not  just 
concerned  with  the  real  risk  but  their  perception  of  risk[l].  Therefore,  not  only 
does  the  real  risk  have  to  be  acceptable,  but  the  public  perception  of  risk  to  airline 
passengers  must  also  be  acceptable. 

The  Federal  Aviation  Administration  (FAA)  has  the  responsibility  of  deciding 
public  policy  issues  relating  to  fire  safety  of  passenger  airplanes.  Fire  risk  analysis 
and  management  for  passengers  is  a very  challenging  task.  What  is  the  risk  due  to 
unwanted  fires  associated  with  passenger  airplanes?  What  steps  can  be  taken  to 
reduce  this  risk?  Do  these  steps  introduce  another  larger  risk?  What  are  the  costs 
of  taking  these  steps?  These  are  some  of  the  questions  that  needed  to  be  answered. 
Making  the  best  decision  possible  relative  to  a particular  fire  safety  system  is 
clearly  very  important.  Lives  can  be  saved  or  lost,  people  can  suffer  unnecessarily 
because  of  injuries,  or  there  can  be  undesirable  flnancial  consequences.  Some 
undesirable  financial  consequences  are: 

• the  direct  fire  losses  associated  with  an  unwanted  fire, 

• the  cost  of  installing  and  maintaining  the  fire  safety  system,  and 

• the  indirect  costs  associated  with  an  unwanted  fire  such  as  the  reduction  of 
the  number  of  persons  flying  after  a major  plane  crash. 

In  fire  risk  analysis  and  management  there  are  no  correct  answers,  only  correct 
procedures.  There  are  no  correct  answers  because  the  final  answer  of  how  to 
manage  risk  depends  upon  the  value  system  of  the  decision  maker.  Since  people 
have  different  values  they  can  arrive  at  different  valid  answers.  On  the  other  hand, 
the  procedure  for  making  a proper  analysis  is  on  firmer  footing  because  of  the  use 
of  logic  and  the  scientific  method.  ”lt  is  now  possible  to  examine  potential  hazards 
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in  a rigorous,  quantitative  fashion  and  thus  to  give  people  and  their  representatives 
facts  on  which  to  base  essential  personal  and  political  decisions.”  [1] 

The  purpose  of  this  report  is  to  describe  the  National  Institute  of  Standards  and 
Technology’s  work  to  date  relating  to  the  general  methodology  being  developed 
for  the  project  Risk  Analysis  for  the  Fire  Safety  of  Airline  Passengers  and  the 
software  being  used  to  facilitate  this  methodology.  The  objective  of  this  project  is 
”...  to  develop  the  generic  methodology  and  an  intelligent  computer  program  that 
will  compute  the  fire  risk  for  passengers  of  airlines  assuming  the  implementation  of 
various  fire  safety  regulations^.”  If  this  project  is  completed,  this  methodology  will 
manifest  itself  as  a computer  program.  This  program  will  allow  determination  of 
the  risk  assuming  the  implementation  or  the  removal  of  various  fire  safety  systems 
or  other  changes  that  impact  the  safety  of  passengers  of  airlines.  This  will  enable 
airlines  or  airplane  manufacturers  to  achieve  the  same  level  of  risk  by  different 
approaches.  This  would  encourage  innovation  by  the  industry  in  improving  safety. 

In  making  an  analysis  of  the  merit  of  a fire  safety  feature  it  is  desirable  to  have  the 
methodology  for  using  the  state-of-the-art  safety  analysis  technology  automated. 
This  would  allow  the  appropriate  use  of: 

• the  historical  data  on  fire  losses  in  airplanes, 

• the  results  of  experiments  and  tests, 

• the  predictions  of  physical  science  models,  and 

• experts’  opinions. 

It  also  would  be  of  value  for  the  program  to  have  the  ability  to  report  the  source  of 
each  piece  of  knowledge  or  assumption  made  that  is  used  in  a particular  analysis. 
The  system  should  allow  various  safety  features  to  be  analyzed  independently  or 
collectively.  It  should  allow  one  to  remove  one  safety  feature  and  replace  it  with 
another.  The  system  should  allow  an  individual  to  make  his/her  own  analysis  by 
making  his  own  assumptions  and  entering  his  own  data.  This  analysis  should  be 
recorded  so  his  inputs  and  conclusions  would  be  available  for  future  reference  and 
review  by  others.  Such  a program  would  make  explicit  the  reasoning  used,  the 
assumptions  made,  and  the  knowledge  used. 

^Contract  with  FAA  Technical  Center  Atlantic  City  New  Jersey.  Contract  number  DTFA03 — 
92— Z— 00018 
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Injuries  or  deaths  due  to  airplane  fires  are  rare  events.  Therefore,  there  is  not  a 
large  body  of  relevant  statistical  data  that  can  be  used  to  determine  the  impact 
of  various  fire  safety  strategies.  One  approach  to  evaluating  the  merit  of  a fire 
safety  system  is  to  do  a cost/benefit  analysis  based  on  an  analysis  of  past  acci- 
dents using  classical  statistical  techniques.  However,  each  crash  is  studied  by  the 
government  so  that  changes  can  be  made  in  procedures  or  equipment  to  reduce 
the  likelihood  of  a similar  accident  occurring.  Therefore,  the  historical  evidence 
available  is  inappropriate  for  the  applications  of  classical  statistical  techniques 
in  fire  risk  analysis  for  airline  passengers  if  significant  changes  are  introduced  to 
avoid  accidents  or  for  other  reasons. 

The  risk  problem  for  airline  passenger  safety  is  very  complex  and  has  large  uncer- 
tainty in  the  relevant  knowledge.  Formal  decision  methods  can  be  used  to  address 
these  types  of  decision  problems  that  are  too  large  and  complex  to  be  dealt  with 
by  intuition.  However,  the  formal  decision  methodology  needs  to  make  intuitive 
sense  to  the  decision  maker. 

A rigorous  risk  analysis  methodology  for  the  FAA  should: 

• Be  based  on  the  most  appropriate  scientific  results  obtained  by  responsible 
and  appropriate  research  practices  [2]  and 

• Follow  sound  professional  practice  for  decision  analysis  [3]. 

In  particular  such  a methodology  should  require  (or  provide  for): 

• the  statement  of  significant  assumptions, 

• the  statement  of  the  decision  criteria, 

• the  sources  of  the  scientific  results  used, 

• the  statement  of  uncertainties  for  all  input  and  output  variables, 

• the  performance  of  a systematic  sensitivity  and  uncertainty  analysis  on  the 
decision  model,  and 

• the  clear  and  complete  documentation  of  the  analysis. 
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Recognizing  the  importance  and  the  difficulty  of  finding  a usable  rigorous  method- 
ology for  their  analyses,  the  FAA  started  this  project.  Because  of  the  lack  of  the 
methodology  being  developed  by  this  project,  previous  analyses  [4]  for  the  FAA 
were  forced  to  fall  short  of  these  requirements.  Without  the  appropriate  auto- 
mated methodology  it  is  extremely  difficult  to  satisfy  all  these  requirements.  The 
methodology  being  developed  in  this  project  will  enable  the  FAA  to  follow  sound 
professional  practice  for  decision  analysis. 

In  the  last  decade  considerable  progress  has  been  made  in  decision  analysis  and  ar- 
tificial intelligence  in  dealing  with  reasoning  with  uncertainty  or  vague  knowledge. 
Some  advances  have  used  Bayesian  probability  theory  [5],  influence  diagrams  [6], 
expert  systems  [7],  and  the  Maximum  Entropy  theory  [8].  This  project  applies 
some  of  these  advances  by  using  influence  diagrams  for  the  risk  analysis  of  the  fire 
safety  of  airline  passengers. 

There  are  three  major  roles  that  must  be  filled  in  order  to  develop  this  methodol- 
ogy successfully:  the  decision  maker,  the  domain  expert,  and  the  decision  analyst. 
The  methodology  is  developed  to  assist  the  decision  maker  in  making  a decision. 
Therefore,  the  decision  maker  must  identify  all  acceptable  alternatives.  He/she 
must  identify  what  he  values  so  various  consequences  can  be  ranked  accordingly 
to  their  desirability  based  on  his  values.  Finally,  he  must  believe  in  or  trust  the 
methodology  for  otherwise  he  will  not  use  it.  In  decisions  relating  to  airline  fire 
safety  there  will  be  relevant  knowledge  available  only  from  certain  scientific  or 
technical  domain  experts.  These  domain  experts,  in  addition  to  supplying  their 
domain  knowledge,  must  concur  that  the  portion  of  the  total  model  that  covers 
their  domain  is  correct.  Finally,  the  role  of  the  decision  analyst  is  to  construct 
the  model  in  cooperation  with  the  decision  maker  and  domain  experts. 

Next  is  a brief  discussion  of  the  influence  diagrams.  This  will  be  followed  by  an 
evaluation  of  the  various  software  shells  that  were  available  initially  to  implement 
the  initial  version  of  this  methodology.  Then  the  current  status  of  the  model 
development  for  the  water  mist  decision  will  be  reviewed.  Finally,  what  remains 
to  be  done  to  finish  this  project  is  discussed. 
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2.  Influence  diagrams 


After  a careful  study  of  the  literature,  the  decision  was  made  to  use  the  newer 
influence  diagram  rather  than  the  traditional  decision  tree.  One  reason  for  this 
choice  was  that  unlike  decision  trees,  influence  diagrams  grow  linearly  with  the 
size  of  the  problem,  while  decision  trees  grow  much  faster.  In  addition,  influence 
diagrams: 

• clearly  and  simply  represent  probabilistic  and  informational  dependencies 
among  problem  variables,  while  decision  trees  do  not, 

• provide  a demonstrable  rational  line  of  reasoning,  and 

• facilitate  the  identification  of  what  portions  of  existing  knowledge  need  im- 
provement for  the  biggest  improvement  in  the  decision  of  interest. 

Therefore,  influence  diagrams  were  selected  rather  than  decision  trees[6]. 

We  will  give  here  a brief  review  of  influence  diagrams.  More  extensive  discussions 
can  be  found  in  the  literature  [6], [9]. 

Influence  diagrams  are  a graphical  representation  of  decisions  where  relevant  vari- 
ables, decisions,  and  consequences  are  represented  by  nodes  and  their  relationships 
are  indicated  by  arcs.  Influence  diagrams  are  a formal,  mathematical,  rigorous 
representation  of  a decision  problem  that  can  be  solved  by  a computer  and  easily 
understood  by  people.  For  any  particular  decision  problem  there  may  be  a num- 
ber of  influence  diagrams  that  correspond  to  a particular  decision.  Thus,  there  is 
not  a unique  influence  diagram  for  any  particular  decision. 

The  principal  components  of  influence  diagrams  are  nodes  and  arcs.  The  most 
important  nodes  represent: 

1.  Decision  variables  which  are  quantities  over  which  the  decision  maker  exer- 
cises direct  control; 
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2.  Value  variables  which  represent  aspects  of  the  preferences  of  the  decision 
maker;  and 

3.  Chance  variables  which  are  uncertain  quantities  that  represent  properties  of 
the  states  of  the  world. 

The  two  types  of  arcs  are  informational  and  conditional  arcs.  Informational  arcs 
are  arcs  which  point  to  a decision  variable.  All  other  arcs  are  conditional  arcs. 
We  will  also  use  a submodel  node  which  is  just  a logical  collection  of  the  above 
nodes. 

In  Figure  2.1  we  show  a minimal  influence  diagram.  The  rectangular  node  labeled 


Safety 

System 


Results 


Figure  2.1:  Minimal  Influence  Diagram 

’’Safety  System”  is  a decision  variable.  It  could  correspond  to  the  decision  of 
whether  or  not  to  have  water  mist  systems  required  on  airlines  or  some  combi- 
nation of  safety  features.  The  hexagonal  node  represents  a value  variable.  The 
arc  connecting  these  two  nodes  is  a conditional  arc,  i.e.,  the  result  depends  upon 
the  decision.  If  two  nodes  are  independent  there  is  no  arc  connecting  them.  Thus 
a non-conditional  arc  is  the  arc  not  drawn.  Figure  2.2  shows  the  first  figure  ex- 
panded by  two  chance  nodes,  deaths  and  costs.  Again  all  the  arcs  are  conditional 
arcs. 

An  influence  diagram  can  be  viewed  at  three  levels:  relationship,  functional,  and 
numerical.  Figure  2.2  shows  the  relationships  between  four  variables.  At  a deeper 
level,  the  functional  relationship  of,  say,  the  death  node  can  be  given  and  included 
in  its  description.  At  a still  deeper  level,  numerical  values  can  be  assigned  where 
appropriate,  and  computed  elsewhere. 
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Figure  2.2:  Expanded  Minimal  Influence  Diagram 


The  model  of  the  decision  process  described  by  Figure  2.2  is  very  simple.  In 
general,  decisions  are  much  more  complex.  For  example,  the  cost  node,  rather 
than  being  a chance  node,  could  be  a submodel.  This  submodel  would  include 
all  the  variables  relevant  to  determining  the  cost  variable.  Therefore,  influence 
diagrams  can  consist  of  many  submodels.  This  allows  the  construction  of  a model 
that  at  the  highest  level  can  be  understood  by  the  decision  maker  without  the 
confusion  of  all  the  details.  It  also  allows  specialists  to  determine  submodels 
associated  with  their  specialty  without  being  distracted  by  other  specialized  areas 
or  the  total  picture.  This  is  an  example  of  the  divide  and  conquer  technique  of 
solving  complex  problems. 

The  influence  diagram  representation  of  the  decision  model  is  developed  by  an 
iterative  and  evolutionary  process  cls  depicted  in  table  2.1  [11].  The  first  model 
developed  is  the  pilot  model  which  is  an  extremely  simplified  representation  of  the 
problem,  useful  only  for  determining  the  most  important  relationships.  When  we 
reach  the  sixth  step,  see  table  2.1,  we  start  over  again  with  the  first  step  for  the 
pilot  model  or  move  on  to  the  prototype  model.  The  prototype  model  is  a quite 
detailed  representation  of  the  problem  that  may,  however,  still  be  lacking  a few 
important  attributes.  It  does  demonstrate  how  the  final  version  will  appear  and 
perform.  Again  when  we  reach  the  sixth  step  we  start  over  again  or  move  on  to 
the  production  model.  This  model  is  the  most  accurate  representation  of  reality 
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Pilot 

model 

Prototype 

model 

Production 

model 

1.  Basis  development 
....  Alternatives 
....  Preferences 

2.  Deterministic  Structuring 
....  Functions 

....  Sensitivity  analysis 

3.  Probabilistic 

....  Value  of  information 

4.  Best  Numbers  or  Distributions 

5.  Basis  Appraisal 

....  Sensitivity  analysis 
....  Value  of  information 
....  Review  preferences 
....  Consensus 

6.  Act  or  iterate 

Table  2.1:  Decision  Analysis  Software  Development  Matrix 


that  decision  analysis  can  produce. 

For  each  of  these  risk  models  the  first  step  is  to  do  the  basic  development  which 
includes  determining  the  decision  maker’s  alternatives  and  preferences.  The  sec- 
ond major  step  consists  of  developing  the  deterministic  structures  of  the  model. 
This  includes  writing  explicit  functional  relationships  that  describe  this  relation- 
ship. Then  a sensitivity  analysis  is  performed  to  identify  variables  that  have  very 
little  influence  and  those  which  have  an  overwhelming  influence.  The  variables 
that  have  very  little  influence  can  be  eliminated  from  the  model  to  simplify  it.  On 
the  other  hand,  the  variables  that  have  an  overwhelming  influence  are  candidates 
for  subdivision  into  more  variables.  The  third  step  is  the  probabilistic  evaluation 
which  includes  the  use  of  probability  distributions  instead  of  unique  values.  This 
step  is  where  the  uncertainty  of  our  knowledge  first  enters.  Therefore,  we  eval- 
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uate  the  value  of  reducing  the  uncertainty  in  the  various  variables  to  determine 
the  effect  of  doing  so  on  our  results.  This  can  potentially  identify  needed  areas 
of  research.  The  fourth  step  consists  of  finding  and  utilizing  the  best  numerical 
values  and  distributions  for  the  variables  in  the  model.  For  the  fifth  step,  the 
basic  appraisal,  the  sensitivity  analysis  and  value  of  information  analysis  are  re- 
peated, a review  of  the  decision  maker’s  preferences  is  made,  and  the  existence  of 
a consensus  on  the  model  is  verified.  At  this  point  the  model  is  either  complete 
or  the  development  process  is  started  over  and  iterated  until  the  decision  maker 
is  satisfied. 
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3.  Software  evaluation 


Buying  good  software  is  almost  always  cheaper  than  developing  it.  Therefore, 
a search  for  software  to  be  used  to  construct  decision  models  was  made  after 
deciding  to  use  influence  diagrams.  The  main  features  the  software  was  to  possess 
were  the  capability  to: 

1.  be  used  to  construct  influence  diagrams, 

2.  operate  on  either  an  IBM- compatible  PC  or  a Macintosh, 

3.  compute  the  influence  diagram  in  a predictive  mode, 

4.  provide  for  extensive  node  definition  and  description, 

5.  allow  probability  distributions  as  definitions  of  values,  and 

6.  be  user-friendly  for  the  construction  and  editing  of  influence  diagrams. 

In  addition,  the  algorithm  used  should  be  verifiable  and  the  source  code  for  the 
program  must  be  available. 

The  software  candidates  that  were  identified  are  given  in  Table  3.1. 


Software 

Platform 

Applications 

Company 

Demos 

KI  DX 
Ergo 
HUGIN 
IDEAL 

Mac 

Mac,  PC 
Mac 

PC,  Unix 
Unix, Mac 

predictive 

diagnosis 

diagnosis 

predictive,  diagnosis 
research 

Lumina 

Knowledge  Ind. 
Noetic  Systems 
Hugin  Expert  A/S 
Rockwell  Science 

Table  3.1:  Available  Software 
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Because  the  software  is  for  risk  assessment,  it  must  be  capable  of  running  pre- 
dictive applications.  The  only  ones  that  will  clearly  do  this  are  Demos,  Hugin, 
and  IDEAL.  Demos  was  the  only  one  available  commercially  at  the  start  of  this 
project  and  the  only  one  that  would  run  on  an  IBM-compatible  PC  or  a Macin- 
tosh. Hugin  only  recently  became  available  for  a PC.  Previously,  it  would  only 
work  on  a Sun  computer.  IDEAL  is  available  free  for  federal  government  agencies. 
The  major  drawback  to  IDEAL  is  that  it  requires  a UNIX  machine  such  as  a Sun 
computer.  Lisp,  and  Clim  to  run  the  most  user-friendly  version.  While  IDEAL 
may  be  more  powerful  and  versatile,  it  would  require  a great  deal  more  of  an 
effort  to  use.  Demos  on  the  other  hand  was  commercially  available,  albeit  in  a 
beta  version,  it  has  a user-friendly  interface,  and  would  run  on  a Macintosh. 

The  beta  version  of  Demos  (version  2.5b2)  is  described  by  Lumina’s  sale  litera- 
ture as  ”...  a Macintosh-based,  graphical  environment  for  creating,  analyzing,  and 
communicating  probabilistic  models  for  risk  and  policy  analysis.”  It  can  crudely 
be  described  as  a graphical  editor  for  influence  diagrams  and  a Monte  Carlo  sim- 
ulator. In  fact  it  has  a number  of  features  that  make  the  creation  of  influence 
diagrams  convenient.  It  has  the  feature  that  uncertainty  for  any  variable  can  be 
expressed  as  a probability  distribution.  This  distribution  can  either  be  a standard 
distribution  — such  as  uniform,  normal,  or  lognormal  — or  it  can  be  a discrete  or 
continuous  distribution  created  by  the  user.  Uncertainties  are  propagated  through 
the  model  to  generate  the  corresponding  uncertainties  in  the  outputs. 

In  addition.  Demos  lets  you  create  a hierarchy  of  models.  This  allows  one  to  orga- 
nize a large  model  into  many  manageable  submodels.  Each  submodel  is  displayed 
in  its  own  window. 

The  simulation  calculation  is  made  using  Latin  hypercube  sampling,  which  is  a 
variant  of  Monte  Carlo  simulation. 

While  Demos  does  not  meet  all  the  desired  requirements,  it  should  enable  a user 
to  at  least  come  close  to  following  a rigorous  risk  analysis  methodology.  It’s  price 
is  about  $1000.  In  the  future,  there  may  be  a need  to  select  different  software  or 
to  write  a special  software  for  the  FAA. 
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4.  An  Operational  Example  of  the 
Working  of  Influence  Diagrams  for 
Risk  Analysis 


Working  an  example  will  help  the  reader  understand  the  power  of  the  influence 
diagram  approach  to  risk  analysis.  Working  with  the  designated  decision  maker 
we  completed  the  first  step  of  the  development  matrix  and  were  developing  the 
deterministic  structuring  of  the  pilot  model  when  worked  stopped.  Because  the 
decision  model  is  far  from  being  completed  no  results  displayed  in  this 
report  relative  to  the  effectiveness  of  a water  mist  system  should  be 
taken  as  rigorously  supportable.  In  fact,  the  model  at  this  stage  of 
development  may  produce  totally  inaccurate  results. 

For  this  case,  we  chose  the  installation  of  a water  mist  fire  suppression  system  on 
passenger  airplanes  [10].  This  system  has  served  as  the  test  bed  for  the  develop- 
ment of  this  project. 

We  are  reporting  on  the  pilot  version  (step  2:  Deterministic  Structuring)  of  the 
risk  model.  A pilot  model  is  an  extremely  simplified  representation  of  the  problem. 
Its  main  use  is  for  determining  the  most  important  relationships.  For  this  version 
the  only  decision  is  whether  or  not  to  add  a water  mist  system  to  the  airplane 
and  the  only  preference  variable  is  the  number  of  deaths.  The  model  determines 
the  expected  number  of  deaths  with  and  without  the  water  mist  system.  The 
model  uses  a subset  of  FAA’s  incapacitation  model  which  addresses  the  effects  of 
temperature,  carbon  monoxide,  carbon  dioxide,  oxygen  depletion,  and  hydrogen 
cyanide. 

Figures  4.1  thru  4.7  show  various  submodels  of  the  FA  A risk  program.  Figure  4.1 
is  at  the  highest  level  of  the  model.  It  shows  one  value  node  (Cost  of  Saving  a 
Life)  and  four  submodel  nodes.  It  shows  that  the  nodes  Costs  and  Fatalities  are 
the  only  nodes  relevant  to  the  Cost  of  Saving  a Life  node.  The  Fatalities  node 
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Figure  4.1:  Water  Mist 


depends  only  on  the  two  nodes: 

1.  Safety  Features  and 

2.  Plane  Types,  Years,  Number  Flights. 

It  is  important  to  recognize  that  the  lack  of  an  arc  is  also  significant,  since  it 
implies  the  independence  of  nodes. 

What  is  in  the  submodel  Fatalities  is  shown  in  Figure  4.2.  The  nodes  with  rounded 
corners  and  heavy  dark  lines  for  their  border  are  submodel  nodes.  The  rounded 
corners  light  line  nodes  are  chance  nodes.  Thus  in  Figure  4.2  we  see  chance  nodes 
as  well  submodel  nodes.  A node  whose  title  is  in  italics  {Number  of  Flights  per 
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year)  is  a ghost  of  a node  that  is  actually  located  elsewhere,  but  is  displayed 
for  informational  purposes.  The  marks  to  the  left  and  to  the  right  of  this  ghost 
node  indicates  at  least  one  arc  pointing  to  and  at  least  one  arc  pointing  away 
from  this  node.  Nodes  with  double-lined  borders  like  the  Total  Deaths  node  are 
deterministic  nodes.  The  relevant  nodes  to  the  node  Total  Deaths  by  Plane  Type 
are  the  nodes  Probability  of  Accident,  Number  of  Flights  per  Year,  and  Number 
Killed  per  Accident.  The  Probability  of  Accident  node  is  the  probability  of  an 
accident  per  flight.  This  point  of  view  looks  at  the  accidents  per  flight.  Another 
equally  valid  point  of  view  is  looking  at  the  probability  of  an  accident  per  hour  of 
flight.  This  IcLst  point  of  view  would  result  in  a different  influence  diagram  than 
the  existing  one. 

Figure  4.3  shows  the  content  of  the  submodel  Number  Killed  per  Accident.  In  this 
submodel  there  are  a number  of  chance  nodes  and  a submodel,  Killed  by  Fire. 
We  can  go  deeper  into  the  model  by  looking  into  the  submodel  Killed  by  Fire 
which  is  shown  in  Figure  4.4.  Figure  4.5  shows  the  content  of  the  submodel  Rate 
of  Deplaning.  The  chance  nodes  in  the  upper  right  hand  corner  of  the  figure  that 
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Figure  4.3:  Number  Killed  per  Accident 

are  partially  crosshatched  are  nodes  that  could  be  added  to  the  model  at  a later 
date,  but  are  not  in  the  model  now.  Still  deeper  into  the  model  we  see  in  Figure 
4.6  the  contents  of  the  submodel  FAA  Degree  of  Incapacitation.  Figure  4.7  shows 
the  contents  of  the  submodel  FED^  Due  to  Toxic  Gases. 

We  now  want  to  turn  to  describing  what  information  is  contained  within  the 
nonsubmodel  nodes.  Figures  4.8  thru  4.13  are  examples  of  what  is  stored  in 
nodes.  Figure  4.8  shows  the  Decision  node  Water  Mist.  We  see  a common  format 
of  information.  On  the  top  line  we  see  the  designation  as  to  what  type  of  node  we 

^Fractional  Effective  Dose  (FED) 
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Figure  4.4:  Killed  by  Fire 


Figure  4.5:  Rate  of  Deplaning 
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Figure  4.6:  FAA  Degree  of  Incapacitation 
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Figure  4.7:  FED  Due  to  Toxic  Gases 
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□ D ecision'v'  Water_mist1 
Title:  Water  Mist 


Units: 


Description:  0 means  no  water  mist,  1 means  there  is  a water  mist  system. 


Definition: 


Outputs: 

o 

o 

o 

o 

o 

o 

o 

o 

o 

o 


Co2_con 

Concent_o2 

Co_concent 

Fraction_w 

Installatil 

Malfunctio 

Netjives_ 

N'umber_of_2 

Planes ... 

Temperatur 

Visibility 


Concentration  of  C02 
Concentration  of  02 
Concentration  of  CO 
Fraction  with  Mist 
Installation  Cost  per  Plane 
Prob.  of  Equip.  Malfunction 
Net  Lives  Saved 
Number  of  Retrofits 
Planes  Manufactured 
Temperature 
Visibility 


Figure  4.8:  Water  Mist 


have.  This  is  followed  by  the  variable  name  used  by  the  computer.  In  this  case 
it  is  Water_mistl.  Finally,  there  is  a place  to  enter  the  units  of  the  variable.  On 
the  next  line  is  the  Title  of  the  node  which  appears  inside  the  node.  Under  the 
Title  is  space  to  type  in  a short  description  of  the  node.  Below  the  Description  is 
where  the  functional  definition  of  the  node  is  given.  For  the  water  mist  variable 
we  have  defined  it  to  be  either  zero  or  one,  i.e.,  no  water  mist  system  or  a water 
mist  system.  Finally,  the  Outputs  list  contains  all  the  variables  in  the  full  model 
that  are  explicitly  dependent  upon  this  node. 

One  has  great  flexibility  in  defining  the  relationship  between  nodes.  For  example. 

Figure  4.9  shows  the  contents  of  a chance  node  Prob.  of  Death  by  Impact  for 

Chance  ^ lmpact_death  Units: 

Title:  Prob.  of 

Death  by  Impact 

Description:  If  an  airplane  crashes,  the  probability  of  being  killed  by  the  impact  of  the 
crash. 

Source  RLS 


Definition: 


Uniform 


( 0.2,  0.28  ) 


Outputs:  Q lmpact_kill  Killed  by  Impact 


Figure  4.9:  Prob.  of  Death  by  Impact 

which  the  ’’definition”  is  a uniform  probability  distribution  over  the  range  0.2  to 
0.28  (arbitrarily  chosen  here  in  order  to  work  the  example).  A number  of  other 
frequently  used  distributions  can  be  used  plus  a custom  distribution  can  be  used. 
Figure  4.10  shows  a chance  node  Concentration  of  CO  which  is  defined  by  use  of 
a table  of  values.  Figure  4.11  shows  this  Table  of  Concentration  of  CO.  Figure 
4.12  shows  the  content  of  the  chance  node  CO  Factor  for  which  the  definition  is 
an  If  ...  then  ...  else  statement.  This  statement  is  from  the  FAA  incapacitation 
model  and  it  says  ”If  the  concentration  of  CO  times  the  factor  Vco2  is  greater 
than  0.01,  then  return  the  value  of  the  concentration  of  CO  times  the  factor  Vco2 
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Units:  percent 


Chance 


Co  concent 


Title:  Concentration 
of  CO 


Description: 


Definition:  Edit  Table  indexed  by  Time  of  Exposure,  Water  Mist 


Inputs:  Expos_time  Time  of  Exposure 

I I \Vater_misl1  Water  Mist 

Outputs:  O Cojactor  CO  Factor 


Figure  4.10:  Concentration  of  CO 


Edit  Table  • Concentration  of 


Time 


of  Exposure  (minutes) 
Water  Mist 


0 

1 

0 

0 

0 

0.5 

0 

^ 

1 

0 

0 

1 .5 

0 

0 

2 

0.08 

0.07 

2.5 

0.23; 

0.21 

3 

0.38 

0.22 

3.5 

0.62; 

0.32 

4 

0.78 

0.33 

Figure  4.11:  Table  of  Concentration  of  CO 


CO 
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(^Chance  Co_factor 

Title:  CO  Factor 


Units: 


Description: 

expr 

Definition:  IF  (Co_concent  * Vco2  >.01)  THEN  (Co_concent  * Vco2/3.425)  ELSE  0 

Inputs:  Co_concent  Concentration  of  CO 

Q Vco2  VC02 

Outputs:  Q Cojncap.  CO  Incap. 


Figure  4.12:  CO  Factor 


divided  by  3.425;  otherwise  return  zero.  The  factor  Vco2  is  defined  as 


.2496*C+1.9086 


where  C is  the  concentration  of  carbon  dioxide.  Figure  4.13  shows  the  definition  of 
the  chance  node  CO  Incap  and  an  integration  of  the  variable  CO  Factor  over  Time 
of  Exposure.  There  are  other  possible  relationships,  but  they  are  too  numerous 
to  try  to  include  them  all. 

Demos  provides  for  a number  of  ways  of  displaying  the  results  of  the  computer 
analysis.  Figures  4.14  and  4.15  show  two  examples  of  how  the  results  can  be 
displayed.  Figure  4.14  shows  the  Cumulative  Probability  of  Total  Deaths  with 
the  water  mist  system  and  without  it.  The  interpretation  of  this  figure  may  be 
helped  by  realizing  that  if  no  one  was  ever  killed,  the  cumulative  probability 
curve  would  have  a constant  value  of  one  for  all  values  of  total  deaths.  The  solid 
curve,  which  corresponds  to  the  results  without  the  water  mist  system,  is  below 
the  dashed  curve,  which  corresponds  to  the  results  with  the  water  mist  system. 
Since  for  any  value  of  constant  cumulative  probability  the  value  for  total  deaths 
is  higher,  this  figure  indicates  the  water  mist  system  is  safer.  However,  we  must 
repeat  the  caution  that  these  results  may  not  be  correct.  In  Figure  4.15  is  shown 
the  Probability  Density  of  Total  Deaths  with  and  without  the  water  mist  system. 
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(^Chance  Cojncap.  Units: 

Title:  CO  Incap. 

Description:  The  FED  due  to caiton  monoxide 

exfir 

Definition:  INTEGRATE  (Cojactor,  Expos_time) 

Inputs:  Co_factor  CO  Factor 

CD  Expos_time  Time  of  Exposure 

Outputs:  Q Fed_gases  Toxicity  Incapacitation 


Figure  4.13:  CO  Incap 

Again  we  see  that  values  of  total  deaths  are  greater  for  the  non-water  mist  case 
than  with  the  water  mist  case.  We  repeat  our  caution  that  these  results 
are  not  based  on  a thorough  analysis  and  therefore  may  be  misleading. 

While  the  project  has  not  completed  step  2 of  the  Pilot  model,  we  felt  it  would 
be  of  interest  to  see  a capability  of  Demos  to  do  value  of  information  analysis. 
Therefore,  we  introduced  probability  distributions  for  six  arbitrary  variables.  Fig- 
ure 4.16  shows  a graph  of  the  relative  importance  of  these  six  chance  variables  in 
determining  the  value  of  the  Total  Deaths  node.  We  see  that  the  variable  on  the 
far  left  is  the  most  important  while  the  one  on  the  far  right  of  the  two  sets  is  the 
least  important.  Therefore,  an  investment  in  improving  the  variable  on  the  left 
would  have  the  biggest  payoff. 
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Cumulative  Probability 


Year  Cl[>1994 

Key:  Water  Mist 


0 

1 


Figure  4.14:  Cumulative  Probability  of  Total  Deaths 
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Probability  Donslly 


Year  i:>  1 9 9 4 

Key:  Water  Mist 


0 

1 


Figure  4.15:  Probability  Density  of  Total  Deaths 


Total  Deaths  Importance 


Plane  Type  ll[> 

Year  1 9 9 4 

Key:  Total  Deaths  Inputs 

X AxisrWater  Mist 

1 1 


0 1 
Water  Mist 


Figure  4.16:  Total  Deaths  Importance 
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5.  What  remains  to  be  done. 


Where  we  stopped  work  in  table  2.1  tells  most  of  the  story  of  what  remains  to 
be  done.  As  has  been  pointed  out,  the  influence  diagram  representation  of  the 
decision  model  is  developed  by  an  iterative  and  evolutionary  process  as  depicted 
in  table  2.1.  Since  work  was  stopped  during  the  second  step  in  developing  the 
pilot  model,  the  work  on  the  pilot  model  needs  to  be  flnished  as  well  as  the  work 
on  the  other  two  models.  For  this  and  the  other  models  it  is  critical  that  we  work 
with  the  decision  maker  or  someone  that  accurately  reflects  his  point  of  view.  If 
the  designated  decision  maker  is  changed,  the  work  on  the  model  to  date  will  have 
to  be  revised  as  needed  to  comply  with  the  decision  maker’s  point  of  view  and 
values. 

For  each  of  three  risk  models: 

1.  The  first  step  is  to  do  the  basic  development  which  includes  determining  the 
decision  maker’s  alternatives  and  preferences. 

2.  The  second  major  step  consists  of  developing  the  deterministic  structures  of 
the  model.  This  includes  writing  an  explicit  functional  relationship  that  de- 
scribes this  relationship.  Then  a sensitivity  analysis  is  performed  to  identify 
variables  that  have  very  little  influence  and  those  that  have  an  overwhelm- 
ing influence.  The  variables  that  have  very  little  influence  can  be  eliminated 
from  the  model  to  simplify  it.  On  the  other  hand,  the  variables  that  have  an 
overwhelming  influence  are  candidates  for  subdivision  into  more  variables. 

3.  The  third  step  is  the  probabilistic  evaluation  which  includes  the  use  of  prob- 
ability distributions  instead  of  unique  values.  At  this  step  is  where  the  un- 
certainty of  our  knowledge  first  enters.  Therefore,  we  determine  the  impact 
of  reducing  the  uncertainty  in  the  various  parameters  on  the  results. 

4.  The  fourth  step  consists  of  flnding  and  utilizing  the  best  numerical  values 
and  distributions  for  the  variables  in  the  model. 
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5.  For  the  fifth  step,  the  basic  appraisal,  the  sensitivity  analysis  and  value  of  in- 
formation analysis  are  repeated,  a review  of  the  decision  maker’s  preferences 
is  made,  and  the  existence  of  a consensus  on  the  model  is  verified. 

6.  At  this  point  the  model  is  either  complete  or  the  development  process  is 
started  over  and  iterated  until  the  decision  maker  is  satisfied. 

When  we  reach  the  sixth  step  we  start  over  again  with  the  first  step  for  the  model 
or  move  on  to  the  next  model  if  there  is  one.  At  this  stage  it  would  be  useful  to 
introduce  the  model  to  the  airline  and  airplane  industries  by  convening  a meeting 
where  anyone  interested  could  comment  on  the  model  and  the  plans  for  the  next 
model. 

Finally,  we  must  continue  the  evaluation  of  implementation  software,  such  as 
Demos. 
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diagrams  is  given.  The  status  of  their  application  to  the  water  mist  system  for  passenger  planes  is  given  and  the  overall  approach  to 
carrying  out  the  project  is  described.  An  example  is  included  that  shows  how  the  process  works,  but  the  case  is  fictional,  not  intended 
to  be  realistic. 
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